IT Security News Blast 9-8-2017

A Cybersecurity Breach at Equifax Left Pretty Much Everyone’s Financial Data Vulnerable

According to the company, criminals were able to access the social security numbers, birth dates, and addresses for a massive—but as yet unspecified—number of U.S. consumers. The hack also included credit card numbers for more than 200,000 Americans and documentation related to disputes, which contain personal and identifying information, for some 180,000 Americans. On top of that, financial disclosures show that three top Equifax executives sold $1.8 million worth of company stock in the days after the breach was discovered, according to Bloomberg.

Why the Equifax breach is very possibly the worst leak of personal info ever

The breach Equifax reported Thursday, however, very possibly is the most severe of all for a simple reason: the breath-taking amount of highly sensitive data it handed over to criminals. By providing full names, Social Security numbers, birth dates, addresses, and, in some cases, driver license numbers, it provided most of the information banks, insurance companies, and other businesses use to confirm consumers are who they claim to be. The theft, by criminals who exploited a security flaw on the Equifax website, opens the troubling prospect the data is now in the hands of hostile governments, criminal gangs, or both and will remain so indefinitely.

The U.S. National Infrastructure Advisory Council, a group commissioned by the president’s National Security Council to review the federal government’s capability to secure critical infrastructure against cyberattacks, recently warned of a “narrow and fleeting window of opportunity before a watershed, 9/11-level cyberattack” occurred against that infrastructure.

Leading the latest edition of the ISMG Security Report: Observations about America’s standing as a global cybersecurity leader from Christopher Painter, who until earlier this summer served as the United States’ top cyber diplomat. In the Security Report (click on player to listen), you’ll also hear:

ISMG Security and Technology Editor Jeremy Kirk report on the potential for a large attack harnessing internet of things devices; and

Hear Equifax CEO Rick Smith apologize to customers for a breach that exposed the data of 143 million customers.

While most military and national intelligence organizations are better prepared to ward off a majority of attacks, many governmental entities are massively unstaffed, underfunded, and unprepared to stave off the standard attacks that target them. Their systems and data are often subjected to resource-constrained security and technology programs that lag in their time to patch/prevent, monitor, detect, and respond to attacks.

When a business, local government, individual or group interacts with state government, there’s often sensitive information involved. Those include things such as names, addresses, Social Security numbers, credit card numbers, and bank account numbers. While the state does a lot to make sure sensitive information isn’t retained if it doesn’t need to be, it has an important duty to make sure what it retains is protected.

The certification in IBM security and analytics solutions teaches cyber security software skills to former and transitioning military personnel, and 100 veterans are expected to complete the course by 8th September. Designed to facilitate employment into cyber security roles, this IBM Corporate Citizenship initiative is part of a wider Veterans Employment Accelerator grant program in the US, Canada and now the UK.

Another study this week by security and compliance firm Tripwire underlines this, with 81 percent of existing security professionals believing that the skills required for the job have changed in the past few years. This shows in the fact that 20 percent of respondents say that their organizations have hired people with expertise not specific to security over the past two years, and another 17 percent say they plan to do the same in the next two years. In addition 50 percent plan to invest more heavily in training their existing staff to help with the looming skills shortage.

The DNC Begins Cybersecurity Effort To Try To Make Sure 2016 Doesn’t Happen Again

For the DNC’s new chief technology officer — now six weeks into his first job in politics after working at Silicon Valley companies like Uber and Twitter — that’s what had to change to prevent the kind of hacks that upended last year’s presidential election. He wants the technology team everywhere. (“My end goal is how do we get to a world where there is no one reporting to the CTO anymore.”) He wants a steady, endless trickle of education about cybersecurity. (“It has to be part of on-boarding. It has to be part of every conversation, every time we have a meeting.”) He wants regular phishing email drills, for the party’s lowest-level staffers up to the chair. (“There’s literally a simulated phishing attack on the DNC right now. We started about an hour ago.”)

Another cyberattack alarm is going off. We need to start paying attention.

FOR THE second time this year, evidence has surfaced of a serious potential threat to electrical and industrial systems from cyberattack. In June, a computer worm spread across the globe that caused systems that were managing oil companies, airline flights and more to lock up, and there was a report that hackers were penetrating a company operating nuclear power plants. Now, a security firm, Symantec, has discovered a wave of malware called Dragonfly in Europe and the United States that could put bad actors in position to switch off the lights.

The issue is that hackers are not starting from nothing here when it comes to new attack domains. As sectors, IoT and connected cars are in their relative infancy, but hackers that are looking to perpetrate attacks in this space are bringing skills from other industries. Security teams looking to protect companies here must do the same and learn from the successes and mistakes made by other industries.

FBI Files: Suspected Breitbart Cyberattack May Just Have Been an Advertising Malfunction

Just-released FBI documents reveal that the agency investigated what appeared to be a massive cyberattack on Steve Bannon’s Breitbart news site in January 2016 — but found that much of the internet traffic believed to be part of an attack was actually caused by a malfunctioning ad network. The unclassified documents do not provide a full picture of the investigation or its outcome, because they are heavily redacted, with names and details removed. But the documents that were released Thursday suggest the attack may not have been as severe as it seemed — and may not even have been an attack.

Wonder why Congress doesn’t clamp down on its gung-ho spies? Well, wonder no more

Between now and the end of the year, a second critical battle between the spy agencies and Congress is going to play out as the NSA and FBI desperately try to retain the ability to spy illegally on American citizens, and lawmakers assess how far they should push back and limit those actions. In this case, the issue is Section 702 of the Foreign Intelligence Services Act (FISA), and it has to be renewed by Congress by December 31 or it will cease to exist. If it is not renewed, it will take with it the NSA’s ability to intercept traffic from foreign intelligence targets.

The Joint Counterterrorism Assessment Team (JCAT), an alliance between the FBI, DHS and the National Counterterrorism Center, told first responders, “We assess with moderate confidence that cyber actors, including those who support violent extremism, are likely to continue targeting first responders on the World Wide Web including by distributing personally identifiable information (PII) for the purpose of soliciting attacks from willing sympathizers in the homeland, hacking government websites, or attacking 911 phone systems to hinder first responders’ ability to respond to crises.”

That prediction has, in fact, become our present reality with breathtaking speed, propelled by the bureaucratic momentum from a full century of state surveillance. Not only are most Americans living under the Argus-eyed gaze of a digital surveillance state, but drones are now in our skies, cameras are an everyday presence in our lives, and the NSA’s net sweeps up the personal messages of millions of people worldwide, Americans included, and penetrates the confidential communications of countless allied nations. The past was indeed prologue.

Want more cybersecurity information?

We may also occasionally send you information about Critical Informatics products and solutions; you can unsubscribe at anytime if desired.Leave this field empty if you're human:

About Critical Informatics

We are world-class information security professionals providing Managed Detection and Response services to help you be secure, compliant, and resilient against threats to the life safety, life-sustaining, and quality-of-life systems and services you provide to clients, customers, constituents, and communities.